So you assume. Have you ever investigated credit card fraud? Perhaps there are edge cases that are more difficult than you imagine.

> Imagine if any other service provider (webmail?) disabled your account frequently to "avoid fraud".

Webmail is absolutely lousy with fraud. Webmail companies explicitly disclaim all liability... so... you kinda bolstered my point there. That is, you helped add the significant texture that companies that disclaim all fraud liability can be pretty lousy at preventing fraud.

To reiterate: The entity that accepts liability should be the entity that draws the line on what risks are acceptable.

Credit card companies are pretty unique in the types and magnitude of risk that they accept and manage. They already do quite a high wire act balancing fraud prevention against user convenience. And despite some things that seem inconvenient on the surface, they are typically still the most convenient way available, by a wide margin, to conduct most payment transactions.